Azure is now bigger, faster, more open, and more secure

http://azure.microsoft.com/blog/2015/01/08/azure-is-now-bigger-faster-more-open-and-more-secure/

by deegles • 12 years ago

166 104 12 years ago

azure.microsoft.com

I assume Microsoft itself has access to the keys in the Key Vault?

lstamour4• 12 years ago

Sure, you can make that assumption. Even with an HSM protecting things, they still own and manage the HSM, not you. But then the same can be said for everything else you run in Microsoft's cloud or any other service provider, really. Once I read that the NSA would sometimes take computers from transport and modify them, I realized the NSA is the type of persistent threat you simply can't avoid. It can't be helped in this day and age.

For more on the HSM service and how it works: http://blogs.technet.com/b/kv/

smacktoward• 12 years ago

Can't be helped technically. The way you solve problems like this is with strong laws and vigorous enforcement, not more/different/better tech.

higherpurpose5• 12 years ago

Why can't the keys be managed in an end-to-end fashion? Wasn't it Cloudflare announcing something like that a few months ago, with clients having their own key-servers that Cloudflare itself can't access?

tracker14• 12 years ago

I have a handful of issues with this...

* MS is managing said Key Vault, meaning they may well be under pressure from the NSA to provide access, without a warrant, and without a target knowing said access was requested.

* The local SSD storage can really only be used for temporary or cache based workloads... if your image ships to another machine in the case of failover, you'll lose that data. It's not a bad thing, but the High Performance (SSD backed) disk storage is still waiting for general availability, been on the wait list for preview for a while.

* The ready ubuntu+docker VM is cool, but I think it's more cool that CoreOS is generally available in the box now.

helper5• 12 years ago

We run all our ec2 instances on ephemeral disk instances. Historically running on ebs was a great way to ensure application downtime.

Ephemeral drives mean you need to change the design of your application to be able to withstand full loss of machines. But it's really not that hard. A good replicated database (riak, cassandra) spanning multiple availability zones gets you 95% of the way there.

tracker14• 12 years ago

I wouldn't really trust doing so with less than say 40-50 servers, which C* can do quite well, but this is very much overkill as an expense for most people.

xnull1guest• 12 years ago

"In another embodiment, a data storage system receives a request from a third party to access a user's stored, encrypted data, where the data is stored in the data storage system according to a predefined policy. The encryption on the data prevents the storage system from gaining access to the encrypted data, while the policy allows the encrypted data to be released upon receiving a threshold number of requests from verified third parties." - Cloud key escrow system, Microsoft Corporation

https://www.google.com/patents/US20120321086

Anyone here speak patentese?

api• 12 years ago

... and the Microsoft perestroika continues. :)

martco• 12 years ago

What do you mean? Do you mean this:

perestroika: ORIGIN Russian, literally ‘restructuring.’

danko• 12 years ago

Perestroika is the era in Soviet history when the USSR began to 'thaw' in its relationship to the West and reform its economic policy to be less collectivized and more capitalistic.

In this case, Microsoft would be the USSR and its policy of closed-source Windows/.NET domination would be the old Communist Party hegemonic philosophy. That would make Satya Nadella Microsoft's Mikhail Gorbachev.

panarky3• 12 years ago

Glasnost?

http://en.wikipedia.org/wiki/Glasnost

mark_l_watson3• 12 years ago

I think Microsoft is doing a good job of reinventing themselves. Azure and Office 365 really are good products. The Linux support on Azure is great and Office 365 runs well on my Android and iOS devices, support on OS X is OK, and the web version of Office 365 is sometimes handy on my Linux laptop.

As far as privacy on their key store goes, I tend to trust Microsoft and Google more than average corporations.

alttab• 12 years ago

Especially considering Microsoft is providing you $150 a month in Azure services for 3 years as part of your participation in their BizSpark program.

mark_l_watson3• 12 years ago

Yes, BizApark is pretty nice. Years ago, when Amazon rolled out EC2s, one of their marketing people gave me a $1000 credit to play with AWS. Microsoft BizSpark is even more generous.

freehunter3• 12 years ago

I'm paying for Microsoft Office for the first time ever (when I've used it in the past it has been provided by school or work) because I can use Office on non-Microsoft platforms now. I can start an Excel document on Windows 8, edit it later on RHEL, and view it on the go on my iPhone. It's the era of the cloud. That's how things should be. It doesn't matter what system I'm running.

semi-extrinsic2• 12 years ago

Unless you're doing something extremely complicated, linking to data outside the Excel file or abusing Excel for a purpose where some other tool would be far better, this interoperability has been provided by open/libre-office and the various mobile office suites (read-only) for many years. Microsoft's attempts at vendor lock-in notwithstanding. This cloudiness is the wrong solution, the right one would be for MS to stop actively sabotaging interoperability.

mrmondo2• 12 years ago

I'm interested to hear you've had a good run with O365 - or organisation (100 people) have been using it for 3 years and it's a nightmare, weekly outages, very poor performance, browser compatibility problems with anything that's not IE, missing emails and to top it off absolutely shocking support.

mark_l_watson3• 12 years ago

Ouch, that does not sound good. I don't use their email service. I signed up to get the 1 terrabyte of OneDrive storage per member of my household, and almost as an afterthought then started using OneNote, Word, and Excel.

panarky3• 12 years ago

Bigger, faster, more open, more secure ... what's missing from this list?

Oh, that's right, how about more uptime?

  Provider               Outages  Total Downtime
  ---------------------- -------- --------------
  Amazon EC2                  12     2.01 hours
  Google Compute Engine       65     3.27 hours
  Microsoft Azure VMs        102    42.80 hours

Source: https://cloudharmony.com/status-1year-of-compute-group-by-re...

And this doesn't show the other Microsoft cloud services that have even worse reliability.

At my company we invested a lot of time trying to make Azure Service Bus and Visual Studio Online work. Both were so dreadfully unreliable as to be unusable.

mindstab• 12 years ago

Hey, at least it's not Veriozon cloud which just told users to power down everything today in preparation for a scheduled 48 hour outage.

http://www.computerworld.com/article/2865802/verizon-warns-e...

cpach• 12 years ago

Wow. That’s just bizarre.

panarky3• 12 years ago

In CloudHarmony's assessment of 49 cloud compute providers, Microsoft Azure was literally dead last in total downtime.

Number 49 out of 49 services.

If Verizon is offline for the entire time, maybe they'll be number 50.

Avitas• 12 years ago

When a company trumpets some bold statements for marketing purposes, I immediately think about the worst or most far-fetched interpretation of their language. I wonder if their marketing people are being coy and the honest truth is, in some ways, the opposite or far less than what they are saying.

clebio2• 12 years ago

With 'more' terminology, I always wonder what the original was. "More" than 1% secure is... not terribly specific. "Best ever" doesn't really mean it's good, just that it's always been worse.

As a side note, I'm not implicating Azure here, just a general context.

Encosia• 12 years ago

There was a pretty painful, several-hour Azure outage recently, but 102 outages is over an order of magnitude higher than my Pingdom/Clicky uptime data for a few sites in US East last year.

FleshGordon• 12 years ago

Probably includes partial outages.

quaffapint• 12 years ago

I have a single instance and other than that big one, my monitor hasn't really gone off, other than during patching. Im not sure what those hours are referring to.

nickbauman4• 12 years ago

That said, I'm a GCP certified engineer. I love GCP, but I can see Google losing the cloud war to Microsoft solely in that Microsoft has a more comprehensible offering (UI and libraries/services) and, most importantly, knows how to market its platform.

dudus• 12 years ago

Is this the certification you are talking about :

https://cloud.google.com/developers/training/exams/

gascloud• 12 years ago

AWS is more comprehensive than both by quite a wide margin. MS does indeed have a long history of relying very heavily on marketing. Time will tell if marketing can paper over the large gap in features.

vidarh• 12 years ago

I'm going to show the Azure downtime numbers to my boss next to the downtime numbers for our private cloud next time I want to ask for a raise....

MartinCron• 12 years ago

Way to set the bar...

23david2• 12 years ago

For IAAS providers, you should care about the uptime of the regions (datacenter) that you are planning to use and the uptime of the specific services that your vms will use within those datacenters. In particular, I recommend paying close attention to the monthly/quarterly uptime trend in addition to aggregate uptime numbers.

And if you really care, try and find out the datacenter(s) your providers will be using and find out the historic performance of their different infrastructure and redundancy providers, and how often they actually test and upgrade their systems.

Look at the difference now when I filter by region and add the region data to the chart... it clearly shows just how hard these comparisons can be:

  Provider               Uptime   Outages  Regions Total Downtime
  ---------------------- -------- ------- -------- --------------
  Google Compute Engine  100%        0     1         0 hours
  Amazon EC2             99.9984%    7     3         0.13 hours
  Microsoft Azure VMs    99.942%     56    6         2.89 hours

https://cloudharmony.com/status-1year-of-compute-in-america_...

smackfu• 12 years ago

Yeah, adding downtime between regions seems like it would mess with the data. Like if you have a single region with 40 hours of downtime, that's much worse than 10 regions with 4 hours of downtime. But represented as the same total.

gamblor956• 12 years ago

Can't possibly be accurate. It's missing the major AWS outage from last year that took down the entire US-East zone for more than half a day.

count2• 12 years ago

US-East is a region made of multiple availability zones. Not all of those zones went down (none of my stuff was offline in 3 of the AZ's, for example).

mcgwiz• 12 years ago

You disingenuously left out the Region column from your copy of the table from the article you linked, which entirely alters the meaning of "Total Downtime". Any explanation for that?

mobiplayer2• 12 years ago

You probably know that security includes availability. Just saying...

venaoy• 12 years ago

A very important issue with Key Vault is: what to do when the Hardware Security Module dies? All electronics fail or stop working at some point. How do you make backups of keys that were on the HSM?

helper5• 12 years ago

The AWS HSM service supports backing to your own HSM: http://aws.amazon.com/cloudhsm/faqs/

lstamour4• 12 years ago

You don't. Keys on an HSM never leave the HSM, is how I think it should work. But your keys in the HSM can encrypt secrets, separate from the HSM's keys, but stored with the same service. You could potentially distribute secrets to multiple HSM-backed services. It's equally possible that the service itself distributes your secrets amongst multiple HSMs.

YubiHSM back in the day, I recall reading, was designed so that you'd want two HSMs, one generates random secrets, the other stores the secrets using keys that never leave the device, if I recall correctly. And the reason it needed two is that the generator would leak parts of its keys with the random data it produced, I think, and so to securely store them, you needed a second device with key generating turned off. I could be out to lunch here, never bought a YubiHSM nor do I have experience with corporate ones. My point, is that there are different uses for HSMs, and it's easy enough to have an insecure use of HSMs, even as simple as generating secrets and storing secrets on the same device.

As to what to do if the key is lost, I suppose it's time to re-issue. :) The goal is to not make too many backups: keeping a key secret is more important than ensuring the key is widely available, right? So it's a balance....

Spooky232• 12 years ago

I don't know about a device operating at the scale that Azure is using, but the key stores on smaller Thales HSMs can absolutely be backed up to smart cards.

Security of key material is all about procedures. With a private CA I helped to setup, we used a quorum based authorization scheme, and the collection of smart cards was distributed among different reporting lines to make collusion between employees difficult.

at-fates-hands• 12 years ago

I'm pretty sure they haven't addressed the old issue of having keeping your FTP credentials in plain text. To me, that's not very secure at all.

Source: http://weblogs.asp.net/bleroy/azure-web-sites-ftp-credential...

"Notice how the password looks encrypted. Well, it’s not really encrypted in fact. This is your password in clear text. It’s just crypto-random gibberish, which is the best kind of password."

What exactly is "crypto-gibberish"?

biot2• 12 years ago

  > What exactly is "crypto-gibberish"?

You generate a random password from the set of inputs that the system allows, usually printable ASCII characters. So instead of a non-gibberish password like "correcthorsebatterystaple" you end up with a gibberish password like "]'gf2~B;](0EnxW>/n%+b*q4{".

  > I'm pretty sure they haven't addressed the old issue of
  > having keeping your FTP credentials in plain text.

Would you complain if it were an API key that was provided to you in plain text?

ghuntley• 12 years ago

Yes, because FTP by design is unencrypted and can be easily sniffed.

steven2012• 12 years ago

Does anyone have any opinions on Google Cloud? We are investigating moving to Google Cloud but I personally am a bit skeptical because they appear to be a distinct #4 behind AWS, Azure and Rackspace. I'm worried that Google Cloud will not get the revenues they want and they will close up shop, like they've done with their other products that were wildly successful. I don't see Google having the same level of commitment as Bezos, who will believe in something and then see it through come hell or high water.

Does Google Cloud have the same functionality and flexibility that AWS or Azure have?

23david2• 12 years ago

Why not build your system out to be cloud agnostic and test out different providers?

higherpurpose5• 12 years ago

I really don't see how Google would exit the cloud service business. It's a core competence of theirs.

People have been saying "I'd rather stick with Evernote than Keep" as well. And less than 2 years later, Keep is still there and being updated (with not that many users I think), while Evernote had just laid off 20 people.

I also think most of Google's "spring cleaning" projects have been small projects that made no money - as in they didn't even have a business model (such as Reader). The cloud business seems to be pretty straightforward - we give you this, you pay us that.

tszming• 12 years ago

The major problem with Google Cloud is you don't when they will be blocked in China (that is 20% of the Internet population, or if you don't care). On the other hand, Microsoft and Amazon have better communication with the China gov.

Aoyagi• 12 years ago

I'm not sure I like what MS is doing. They're innovating (or at least fixing things) almost exclusively only in cloud/online services/products.

wmf• 12 years ago

Windows Server will let you run your own Azure, but you can't run your own EC2 or GCE.

_delirium2• 12 years ago

Amazon themselves don't provide a way to run your own EC2, but Eucalyptus [1] is an open-source implementation that works for some use-cases. I believe OpenStack and CloudStack also implement a good portion of the AWS APIs.

[1] https://www.eucalyptus.com/

walterbell• 12 years ago

Board-level changes at Microsoft over the last year or two have placed a higher priority on platform-agnostic cloud services, vs. Windows. Hence new versions of Windows that are free, but collect usage data from bundled services, like Google does.

davexunit• 12 years ago

A good example of openwashing. You can call anything open these days, even proprietary software!

Someone1234• 12 years ago

The term "open" only appears once in the article on this line (aside from the title):

Building on our openness with the availability of the first Docker Image in the Microsoft Azure Marketplace

What the hell does "building on our openness" even mean in that context? I've read it several times and it makes no sense. It is great that they added Docker images (really) but maybe someone technical at Microsoft should start to proofread what nonsense that the marketing department spews out.

higherpurpose5• 12 years ago

You mean aside from the title that every other news site will reproduce and which will be everything most people remember?

MichaelGG• 12 years ago

Azure needs to provide SSD backed options for all blobs. As is, they encourage you to use local SSD storage, which gets wiped on reboot.

egsec2• 12 years ago

Am I comparing the right things for the pricing on AWS Cloud HSM vs Azure Key Vault?

ASW Cloud HSM - http://aws.amazon.com/cloudhsm/pricing/

Azure Key Vault - http://azure.microsoft.com/en-us/pricing/details/key-vault/

The metrics they use are not the same, so I am not sure if the AWS option is something dedicated vs the MSFT one is something you share? Is there something different from AWS that is more comparable?

count2• 12 years ago

I think the AWS Cloud HSM is dedicated, but not sure. They look to be about the same. If you don't need FIPS, AWS also has the new KMS service which is way cheaper than Cloud HSM.

egsec2• 12 years ago

The pricing model looks much more similar for KMS: http://aws.amazon.com/kms/

erazor422• 12 years ago

We run 50+ linux server on azure (west europe) and it's a nightmare, vm reboot unplanned,VHD diseappear. Timeout or unreachable blob files on HDInsight (with PIG)... Slow load balancer not really configurable. Website slow++. I won't recommand it... Very hard for us to keep a professional SLA.

Maybe it's because we run linux server ?

One good point is cheap blob, slow but cheap.

clebio2• 12 years ago

Is it feasible for you to evaluate an AWS deployment? I'd be very interested in the numbers you mention if we could compare them to something directly.

erazor422• 12 years ago

Nop we don't want to deploy on AWS for contract issue. But we are moving on full dedicated OVH. I cannot provide numbers for OVH but for now we are SLA 100% on those server.

mrmondo2• 12 years ago

It's really unreliable though, it seems they're battling outages every few days.

vvoyer• 12 years ago

I recently had to use the Azure various APIS like ServiceBus.

It's a complete failure once you get lost in bugs, missing or hard to find API documentation or examples like `var serviceBusService = azure.createServiceBusService();` WELL Mister API Designer you failed!

aarisa• 12 years ago

Bigger, fast, more open, more secure. Where does that leave Azure, given where it started? It means it's still small, slow, closed, and insecure.

ktavera• 12 years ago

I've been using Azure Websites to host 10 web apps monitoring with nodeping and have not had noticeable downtime in 2014. Maybe it's just their IaaS and not the PaaS

StudyAnimal• 12 years ago

"It IS faster! Over five million..."

Morphling• 12 years ago

I actually think Azure is nice platform, but they've effectively priced me out.

What I mean is that if I want a basic VPS on Azure it costs ~10€/mo to run the server for the month, but there are many VPS providers who offer a lot better hardware for same price.

I guess Azure is meant for bigger needs than mine where you can run 100-200€/mo by default and then scale up when needed, but since my little blog + test/dev server won't need to be scaled it just seems too expensive.

mobiplayer2• 12 years ago

If you plan on building something, but your needs are not there yet you may want to apply for a BizSpark account that covers $150/mo if I'm not wrong. OTOH for a blog you may want to check the PaaS offerings (e.g. Azure Websites).

sudioStudio64• 12 years ago

The truth is that a lot of you refuse to learn how windows works at a deep level, at least as deep as you know UNIX. Then it doesn't work like UNIX... and then you're angry.

I have seen similar horror stories from AWS customers. They probably weren't early adopters like people on HN...who now have the kinks worked out.

MS should stop trying to impress the HN crowd. And unless you own stock in these companies you need to stop investing so much personal emotion in how they are doing compared to each other. AWS isn't some scrappy upstart from a Horatio Alger novel. MS isn't the Empire from Star Wars. And none of them give a damn about you.

toddkaufmann• 12 years ago

Whenever I hear about Microsoft, I just think irrelevant. Am I bad? Sometimes I think I might have missed out on something, but in 30+ years of programming I've never done any real development on it (unless you count java), and I often go months without encountering it (except for remote desktop occasionally).

I think it was good to have competition Apple/Linux/Google, but it doesn't seem like they've kept up.

Azure is now bigger, faster, more open, and more secure

Related Stories